diff --git a/examples/filter-images.yaml b/examples/filter-images.yaml
index 78af324..2889791 100644
--- a/examples/filter-images.yaml
+++ b/examples/filter-images.yaml
@@ -20,6 +20,7 @@
 - node
 - postgres
 - redis
+
 # xos-core images
 - xosproject/chameleon
 - xosproject/xos-base
@@ -63,3 +64,4 @@
 - xosproject/exampleservice-synchronizer
 - xosproject/simpleexampleservice-synchronizer
 - xosproject/xos-api-tester
+- xosproject/tosca-loader
diff --git a/examples/image-tag-candidate.yaml b/examples/image-tag-candidate.yaml
index 5e41ac8..108c0af 100644
--- a/examples/image-tag-candidate.yaml
+++ b/examples/image-tag-candidate.yaml
@@ -20,6 +20,7 @@
 xos_chameleonImage: 'xosproject/chameleon:candidate'
 xos_toscaImage: 'xosproject/xos-tosca:candidate'
 xos_api_testerImage: 'xosproject/xos-api-tester:candidate'
+tosca_loaderImage: 'xosproject/tosca-loader:candidate'
 
 # in xos-gui sub-chart required by xos-core chart
 xos-gui:
diff --git a/xos-core/templates/core-secrets.yaml b/xos-core/templates/core-secrets.yaml
new file mode 100644
index 0000000..9d5a7c5
--- /dev/null
+++ b/xos-core/templates/core-secrets.yaml
@@ -0,0 +1,24 @@
+---
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: xos-admin-passwd-secret
+  namespace: default
+type: Opaque
+data:
+  password: {{ .Values.xosAdminPassword | b64enc }}
+
diff --git a/xos-core/templates/tests/test-xos-core-api.yaml b/xos-core/templates/tests/test-xos-core-api.yaml
index 24c7a8c..7899b00 100644
--- a/xos-core/templates/tests/test-xos-core-api.yaml
+++ b/xos-core/templates/tests/test-xos-core-api.yaml
@@ -35,12 +35,15 @@
           value: 'xos-chameleon'
         - name: SERVER_PORT
           value: '9101'
+        - name: SITE_NAME
+          value: {{ .Values.cordSiteName | quote }}
         - name: XOS_USER
           value: {{ .Values.xosAdminUser | quote }}
         - name: XOS_PASSWD
-          value: {{ .Values.xosAdminPassword | quote}}
-        - name: SITE_NAME
-          value: {{ .Values.cordSiteName | quote }}
+          valueFrom:
+            secretKeyRef:
+              name: xos-admin-passwd-secret
+              key: password
       command: ["pybot", "-L", "TRACE", "-d", "Log", "-T", "Ch_DeploymentTest.txt", "Ch_SiteTest.txt", "Ch_UsersTest.txt", "Ch_SliceTest.txt", "Ch_ServiceTest.txt"]
   volumes:
     - name: log-volume
diff --git a/xos-profiles/base-kubernetes/templates/tosca-job.yaml b/xos-profiles/base-kubernetes/templates/tosca-job.yaml
index fbc8ed0..ded25f3 100644
--- a/xos-profiles/base-kubernetes/templates/tosca-job.yaml
+++ b/xos-profiles/base-kubernetes/templates/tosca-job.yaml
@@ -36,18 +36,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: base-kubernetes-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/base-kubernetes/values.yaml b/xos-profiles/base-kubernetes/values.yaml
index 15b7d6c..a9e490d 100644
--- a/xos-profiles/base-kubernetes/values.yaml
+++ b/xos-profiles/base-kubernetes/values.yaml
@@ -25,7 +25,7 @@
 imagePullPolicy: 'IfNotPresent'
 
 rcord_synchronizerImage: "xosproject/rcord-synchronizer:master"
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xosAdminUser: "admin@opencord.org"
 xosAdminPassword: "letmein"
diff --git a/xos-profiles/base-openstack/templates/tosca-job.yaml b/xos-profiles/base-openstack/templates/tosca-job.yaml
index ca3d280..764595c 100644
--- a/xos-profiles/base-openstack/templates/tosca-job.yaml
+++ b/xos-profiles/base-openstack/templates/tosca-job.yaml
@@ -35,18 +35,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: base-openstack-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/base-openstack/values.yaml b/xos-profiles/base-openstack/values.yaml
index a56e377..d5c1d86 100644
--- a/xos-profiles/base-openstack/values.yaml
+++ b/xos-profiles/base-openstack/values.yaml
@@ -24,7 +24,7 @@
 
 imagePullPolicy: 'Always'
 
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xosAdminUser: "admin@opencord.org"
 xosAdminPassword: "letmein"
diff --git a/xos-profiles/demo-exampleservice/templates/tosca-job.yaml b/xos-profiles/demo-exampleservice/templates/tosca-job.yaml
index 6b9b529..e08cf33 100644
--- a/xos-profiles/demo-exampleservice/templates/tosca-job.yaml
+++ b/xos-profiles/demo-exampleservice/templates/tosca-job.yaml
@@ -35,18 +35,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: demo-exampleservice-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/demo-exampleservice/values.yaml b/xos-profiles/demo-exampleservice/values.yaml
index 59fc79f..eccf195 100644
--- a/xos-profiles/demo-exampleservice/values.yaml
+++ b/xos-profiles/demo-exampleservice/values.yaml
@@ -24,7 +24,7 @@
 
 imagePullPolicy: 'IfNotPresent'
 
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xosAdminUser: "admin@opencord.org"
 xosAdminPassword: "letmein"
diff --git a/xos-profiles/demo-simpleexampleservice/templates/tosca-job.yaml b/xos-profiles/demo-simpleexampleservice/templates/tosca-job.yaml
index 7de92a2..3c5380d 100644
--- a/xos-profiles/demo-simpleexampleservice/templates/tosca-job.yaml
+++ b/xos-profiles/demo-simpleexampleservice/templates/tosca-job.yaml
@@ -35,18 +35,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: demo-simpleexampleservice-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/demo-simpleexampleservice/values.yaml b/xos-profiles/demo-simpleexampleservice/values.yaml
index e61ec52..1a4c19a 100644
--- a/xos-profiles/demo-simpleexampleservice/values.yaml
+++ b/xos-profiles/demo-simpleexampleservice/values.yaml
@@ -24,7 +24,7 @@
 
 imagePullPolicy: 'IfNotPresent'
 
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xosAdminUser: "admin@opencord.org"
 xosAdminPassword: "letmein"
diff --git a/xos-profiles/mcord/templates/tosca-job.yaml b/xos-profiles/mcord/templates/tosca-job.yaml
index 290bd5b..4410b85 100644
--- a/xos-profiles/mcord/templates/tosca-job.yaml
+++ b/xos-profiles/mcord/templates/tosca-job.yaml
@@ -35,18 +35,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: mcord-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/mcord/values.yaml b/xos-profiles/mcord/values.yaml
index 3c916d2..9c0b385 100644
--- a/xos-profiles/mcord/values.yaml
+++ b/xos-profiles/mcord/values.yaml
@@ -24,7 +24,7 @@
 
 imagePullPolicy: 'IfNotPresent'
 
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xosAdminUser: &adminuser "admin@opencord.org"
 xosAdminPassword: &adminpass "letmein"
diff --git a/xos-profiles/rcord-lite/templates/tosca-job.yaml b/xos-profiles/rcord-lite/templates/tosca-job.yaml
index 739d39a..ae4f9da 100644
--- a/xos-profiles/rcord-lite/templates/tosca-job.yaml
+++ b/xos-profiles/rcord-lite/templates/tosca-job.yaml
@@ -36,18 +36,16 @@
       restartPolicy: OnFailure
       containers:
         - name: {{ .Chart.Name }}-tosca-loader
-          image: {{ .Values.httpieImage | quote }}
+          image: {{ .Values.tosca_loaderImage | quote }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
-          command: ["/bin/sh"]
-          args:
-            - "-c"
-            - |
-              for recipe in /opt/tosca/*
-              do
-                echo $recipe
-                http --check-status --ignore-stdin POST http://xos-tosca:$XOS_TOSCA_SERVICE_PORT/run xos-username:{{ .Values.xosAdminUser }} xos-password:{{ .Values.xosAdminPassword }} @$recipe || exit 1
-                echo ''
-              done
+          env:
+            - name: XOS_USER
+              value: {{ .Values.xosAdminUser }}
+            - name: XOS_PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: xos-admin-passwd-secret
+                  key: password
           volumeMounts:
             - name: rcord-lite-tosca
               mountPath: /opt/tosca
diff --git a/xos-profiles/rcord-lite/values.yaml b/xos-profiles/rcord-lite/values.yaml
index f39a806..e0b0cd6 100644
--- a/xos-profiles/rcord-lite/values.yaml
+++ b/xos-profiles/rcord-lite/values.yaml
@@ -25,7 +25,7 @@
 imagePullPolicy: 'Always'
 
 rcord_synchronizerImage: "xosproject/rcord-synchronizer:master"
-httpieImage: "clue/httpie:latest"
+tosca_loaderImage: "xosproject/tosca-loader:master"
 
 xos_api_testerImage: 'xosproject/xos-api-tester:master'